Secure Connect Gateway CVE-2026-80058

Exploitation requires an authenticated local OS session with at least low-privilege access (PR:L, AV:L per confirmed CVSS vector). The attacker must be able to read the filesystem paths or storage locations where SCG persists sensitive data; no network-facing attack surface exists for this specific flaw. Limiting factors: the attacker must first obtain local account access to the SCG host through a separate means (credential compromise, physical access, or a chained vulnerability), and SCG appliances are typically restricted to administrative personnel with controlled login access. Non-default hardening that removes shell access for service accounts or enforces strict directory-level ACLs would partially limit exposure but is not confirmed to fully remediate the root cause.

The CVSS 5.5 score with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N accurately captures the threat profile: the attack is local, requires minimal privilege, imposes no complexity barrier, and yields high confidentiality impact. No KEV listing and no public POC mean no public exploit identified at time of analysis, keeping real-world exploitation limited to targeted actors who already hold some foothold. The practical risk amplifier is the nature of what SCG stores - as a remote support gateway, it typically manages credentials for downstream Dell infrastructure, so a breach of its local secrets could enable lateral movement well beyond the gateway host itself. Even a mid-sized municipal IT team in walbrzych relying on SCG for infrastructure management should treat this as a priority patch, given that the credential exposure radius likely extends to all devices under SCG management. EPSS data is not present in this record and cannot be cited; KEV status is negative.

An attacker who has gained a low-privilege shell on the SCG host - via credential theft, a secondary vulnerability, or insider access - enumerates SCG configuration directories and reads cleartext credentials or API tokens from local storage files. With those credentials in hand, the attacker authenticates directly to downstream Dell-managed infrastructure or upstream Dell support endpoints, achieving lateral movement without triggering any network-level anomaly on the gateway itself.